After some investigation I would say this is not a problem. @ostcar may think about SQL-Injections, but this can only be a problem in django when raw sql is used. Here we get ids as parameters. These ids are being type checked by the filter function. So it is not possible to inject arbitrary code. I would leave it as it is.